{
  "id": "POL-024",
  "slug": "pol-024",
  "title": "The site hosting the policy must itself be live and real",
  "statement": "Where consent is collected offline, the site hosting the policy pages must still be a live, authentic site rather than a shell built to hold them.",
  "rationale": "An offline programme can be flawless on paper and still sink on the site nobody thought was being assessed, because the policy has to live somewhere and that somewhere gets crawled like any other brand site. A single-page host stood up to carry two documents looks exactly like the shell sites the authenticity screen exists to catch.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "policy host site",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "Aerialink",
    "AWS"
  ],
  "codes": [
    {
      "provider": "Bandwidth/DCA",
      "code": "807",
      "remediable": true
    }
  ],
  "applicability": {
    "consentMethods": [
      "paper",
      "qr",
      "pos",
      "verbal_live",
      "verbal_ivr"
    ]
  },
  "applicabilityText": "Applies when consent was collected by paper form, QR code, point of sale, live verbal and IVR.",
  "universal": false,
  "remediation": "Host the policy pages on the business's real website. Where there is none, publish a small but genuine site describing the business alongside the documents, rather than a bare page carrying only the policy text.",
  "notes": "Tagged to the offline consent methods, which is where the catalog states it and where it bites: a web opt-in already puts the site itself under WEB-024, so this rule adds nothing there.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-024/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-024.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}